KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Luka w WWBN AVideo umożliwia atak DNS-rebinding przez niewłaściwe użycie CURLOPT_RESOLVE.
Brak weryfikacji podpisu HMAC w TypeBot umożliwia atakującym wysyłanie fałszywych wiadomości.
Ujawnienie wrażliwych informacji w Power Automate umożliwia atakującemu ich wyciek przez sieć.
Niewystarczające egzekwowanie polityki w Google Chrome pozwala na obejście ograniczeń hosta przez złośliwe rozszerzenia.
Brak ochrony CSRF w Parse Dashboard pozwala na atak typu cross-site request forgery.
The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gateway return requests, relying on a merchant secret that is empty on a store which has not entered its credentials, allowing unauthenticated attackers to mark arbitrary orders as paid and to…
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Stored XSS.This issue affects Prime Slider – Addons For Elementor: from n/a through 4.7.1.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.4.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureForms sureforms allows Stored XSS.This issue affects SureForms: from n/a through 2.12.7.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.110.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through 5.2.8.
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. While…
An Authentication Bypass vulnerability existed where the application bundled an interpreter (Python) that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle By executing the bundled interpreter directly the attacker's scripts…
Niewystarczająca kontrola dostępu w Cisco Catalyst SD-WAN Manager pozwala na ujawnienie wrażliwych informacji.
The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in administrator re-link the integration to an attacker-controlled account via a crafted request (CSRF), taking over the site's Patreon integration.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IDX Broker IMPress for IDX Broker idx-broker-platinum allows Stored XSS.This issue affects IMPress for IDX Broker: from n/a through 3.3.1.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Simpler SEO fv-all-in-one-seo-pack allows Stored XSS.This issue affects FV Simpler SEO: from n/a through 1.9.7.
Błąd zapisu poza granicami w IBM AIX i PowerVM VIOS pozwala lokalnemu atakującemu na zdalne zablokowanie systemu.
Podatność CSRF w Auto Prune Posts umożliwia nieautoryzowane działania na stronie.
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a local privilege escalation via the db2pd utility.
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an authenticated user to forge signature requests due to improper verification of data authenticity.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Wishlist yith-woocommerce-wishlist allows Stored XSS.This issue affects YITH WooCommerce Wishlist: from n/a through 4.18.1.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.com e2pdf e2pdf allows Stored XSS.This issue affects e2pdf: from n/a through 1.32.57.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Luka w WWBN AVideo umożliwia atak DNS-rebinding przez niewłaściwe użycie CURLOPT_RESOLVE. | Luka w WWBN AVideo umożliwia atak DNS-rebinding przez niewłaściwe użycie CURLOPT_RESOLVE. |
Do wiadomości | 6,5 | 0,14 % | ||
| Brak weryfikacji podpisu HMAC w TypeBot umożliwia atakującym wysyłanie fałszywych wiadomości. | Brak weryfikacji podpisu HMAC w TypeBot umożliwia atakującym wysyłanie fałszywych wiadomości. |
Do wiadomości | 6,5 | 0,14 % | ||
| Ujawnienie wrażliwych informacji w Power Automate umożliwia atakującemu ich wyciek przez sieć. | Ujawnienie wrażliwych informacji w Power Automate umożliwia atakującemu ich wyciek przez sieć. |
Do wiadomości | 6,5 | 0,14 % | ||
| Niewystarczające egzekwowanie polityki w Google Chrome pozwala na obejście ograniczeń hosta przez złośliwe rozszerzenia. | Niewystarczające egzekwowanie polityki w Google Chrome pozwala na obejście ograniczeń hosta przez złośliwe rozszerzenia. |
Do wiadomości | 6,5 | 0,14 % | ||
| Brak ochrony CSRF w Parse Dashboard pozwala na atak typu cross-site request forgery. | Brak ochrony CSRF w Parse Dashboard pozwala na atak typu cross-site request forgery. |
Do wiadomości | 6,5 | 0,14 % | ||
| The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gateway return requests, relying… | The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gateway return requests, relying on a merchant secret that is empty on a store which has not entered its credentials, allowing unauthenticated attackers to mark arbitrary orders as paid and to… |
Do wiadomości | 6,5 | 0,14 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Stored XSS.This issue affects Prime Slider – Addons For Elementor: from n/a through 4.7.1. |
Do wiadomości | 6,5 | 0,14 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.4. |
Do wiadomości | 6,5 | 0,14 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureForms sureforms… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureForms sureforms allows Stored XSS.This issue affects SureForms: from n/a through 2.12.7. |
Do wiadomości | 6,5 | 0,14 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0. |
Do wiadomości | 6,5 | 0,14 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.110. |
Do wiadomości | 6,5 | 0,14 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill User Registration… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through 5.2.8. |
Do wiadomości | 6,5 | 0,14 % | ||
| Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. While… |
Do wiadomości | 6,5 | 0,14 % | ||
| An Authentication Bypass vulnerability existed where the application bundled an interpreter (Python) that inherits the Transparency,… | An Authentication Bypass vulnerability existed where the application bundled an interpreter (Python) that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle By executing the bundled interpreter directly the attacker's scripts… |
Do wiadomości | 6,5 | 0,14 % | ||
| Niewystarczająca kontrola dostępu w Cisco Catalyst SD-WAN Manager pozwala na ujawnienie wrażliwych informacji. | Niewystarczająca kontrola dostępu w Cisco Catalyst SD-WAN Manager pozwala na ujawnienie wrażliwych informacji. |
Do wiadomości | 6,5 | 0,13 % | ||
| The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to… | The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in administrator re-link the integration to an attacker-controlled account via a crafted request (CSRF), taking over the site's Patreon integration. |
Do wiadomości | 6,5 | 0,13 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0. |
Do wiadomości | 6,5 | 0,13 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IDX Broker IMPress for IDX Broker… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IDX Broker IMPress for IDX Broker idx-broker-platinum allows Stored XSS.This issue affects IMPress for IDX Broker: from n/a through 3.3.1. |
Do wiadomości | 6,5 | 0,13 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Simpler SEO… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Simpler SEO fv-all-in-one-seo-pack allows Stored XSS.This issue affects FV Simpler SEO: from n/a through 1.9.7. |
Do wiadomości | 6,5 | 0,13 % | ||
| Błąd zapisu poza granicami w IBM AIX i PowerVM VIOS pozwala lokalnemu atakującemu na zdalne zablokowanie systemu. | Błąd zapisu poza granicami w IBM AIX i PowerVM VIOS pozwala lokalnemu atakującemu na zdalne zablokowanie systemu. |
Do wiadomości | 6,5 | 0,13 % | ||
| Podatność CSRF w Auto Prune Posts umożliwia nieautoryzowane działania na stronie. | Podatność CSRF w Auto Prune Posts umożliwia nieautoryzowane działania na stronie. |
Do wiadomości | 6,5 | 0,13 % | ||
| IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a local privilege escalation via the db2pd utility. | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a local privilege escalation via the db2pd utility. |
Do wiadomości | 6,5 | 0,13 % | ||
| IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could… | IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an authenticated user to forge signature requests due to improper verification of data authenticity. |
Do wiadomości | 6,5 | 0,13 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Wishlist… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Wishlist yith-woocommerce-wishlist allows Stored XSS.This issue affects YITH WooCommerce Wishlist: from n/a through 4.18.1. |
Do wiadomości | 6,5 | 0,13 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.com e2pdf e2pdf allows Stored… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.com e2pdf e2pdf allows Stored XSS.This issue affects e2pdf: from n/a through 1.32.57. |
Do wiadomości | 6,5 | 0,13 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.